About three in four EU employees said they received suspicious emails, text or voice messages, or links at work in the six months before a 2026 survey. That is reported exposure to suspicious material—not evidence that 74% were hacked or that their employers suffered confirmed breaches.
Did three in four EU workers actually get hacked?
No. The European Union Agency for Cybersecurity (ENISA) says 74% of employees surveyed had received suspicious emails, text or voice messages, or links at work during the preceding six months. The European Commission described the result as “three in four.” Both statements concern encountering suspicious material; neither says that those messages succeeded, compromised a device or account, or caused a confirmed breach.
As an Amazon Associate I earn from qualifying purchases.
The survey record is the European Commission’s Eurobarometer survey 3681 (survey record). The Commission and ENISA published their summaries on 30 September 2026: European Commission summary and ENISA summary.
What cyber threats do workers face at work?
Phishing and other fraudulent messages or websites designed to steal data or gain unauthorised access were the most commonly reported category: 39% of employees reported them, according to the Commission. Other reported threats included attempts to steal personal data, malware, password theft and AI-generated scams.
#1 Best Overall
| Threat reported | Employees reporting it |
|---|---|
| Phishing or fraudulent messages or websites designed to steal data or obtain unauthorised access | 39% (European Commission, 2026) |
| Attempts to steal personal data | 18% (European Commission, 2026) |
| Malware attacks | 17% (European Commission, 2026) |
| Attempts to steal passwords | 16% (European Commission, 2026) |
| AI-generated scams | 15% (European Commission, 2026) |
These categories should not be added together as if every employee selected exactly one: the Commission does not present them as mutually exclusive. The percentages describe employee reports, not verified attack counts.
Can workers recognise AI-generated scams?
The Commission says 48% of employees said they could recognise an AI-generated fake video. That is a self-reported ability, not a test of how accurately respondents identify deepfakes in practice. It also sits alongside broad concern about risk: 83% said the potential consequences of cyberattacks are serious.
Rank #2
What does the survey say about workplace preparedness?
ENISA reports that 82% of employees rated their organisation’s digital systems and tools effective against cyberattacks. This is employees’ perception, not an independent technical assessment. ENISA also says 45% reported that their organisation sends regular cybersecurity information or awareness updates.
On training, 85% of employees surveyed were interested in improving their cybersecurity skills, while 26% cited lack of time at work as an obstacle. Those figures point to an implementation challenge: interest does not guarantee that workers can make time for training, and awareness activity by itself does not establish that an organisation is secure or that incidents will be prevented. ENISA points organisations to its public Awareness Raising-in-a-Box resource.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why might employees report no incidents?
The Commission says 18% of respondents reported that their organisation had experienced no cyber incident “as far as they are aware.” The qualification matters: employees may not know about incidents handled internally or not disclosed to them. This response should not be read as proof that those organisations had no incidents.
Quick Recap
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Rank #4
What the figures do—and do not—show
- They show reported exposure: suspicious messages and links reached many employees in the six months before the survey.
- They do not measure successful compromise: the exposure figure is not a count of hacked workers, breached accounts or confirmed organisational incidents.
- Preparedness figures are perceptions and reported activity: employees’ confidence in tools and accounts of awareness updates are not security audits or evidence of outcomes.
- The published summaries are EU-wide: the cited official summaries do not provide country-by-country findings. The detailed methodology and results should be consulted before drawing conclusions about sample size, fieldwork dates or national differences.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
